Systems and method for malware detection

Abstract

A system and method for distinguishing human input events from malware-generated events includes one or more central processing units (CPUs), one or more input devices and memory. The memory includes program code that when executed by the CPU causes the CPU to obtain a first set of input events from a user utilizing the input device. The first input events are used to obtain or derive a feature indicative of the user, such as a multi-dimensional feature vector as provided by a support vector machine. Second input events are then obtained, and the second input events are classified against the feature to determine if either the user or malware initiated the second input events.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS[0001]This application claims the benefit of U.S. Provisional Application 61 / 210,097, filed on Mar. 13, 2009, which is incorporated herein by reference in its entirety.STATEMENT REGARDING FEDERALLY FUNDED RESEARCH[0002]The Research Leading to the present invention was supported in part, by National Science Foundation Grant No. CCF-0648985. Accordingly, the U.S. Government may have certain rights in this invention.STATEMENT OF INDUSTRIAL APPLICABILITY[0003]The present invention has industrial applicability in all areas involving computer use, equipment, software and manufacture.FIELD OF THE INVENTION[0004]The present invention relates generally to malware detection systems and methods. More particularly, the present invention discloses malware detection systems and methods that distinguish computer usage patterns of a human user from those of the malware to facilitate detection of the malware.BACKGROUND OF THE INVENTION[0005]Several studies have...

AI Technical Summary

Benefits of technology

[0012]Certain specific embodiments employ principle component analysis to reduce the dimensionality of the feature vector so as to increase processing speeds, increase classification accuracies, or both.

[0016]Certain embodiments determine if the packet originates from any known application obtained from a process table. Preferred embodiments permit the packet to be sent as outbound traffic prior to completing verification of the signature so as to avoid any bottlenecks.

Problems solved by technology

The victim's computing experience also suffers as the computing cycles wasted on bot-induced (i.e, computer generated) events and activities typically slow down the performance of the machine.

Determining whether a personal computer (PC) managed by an average Internet user is infected or not can be very challenging.

Malicious bots are stealthy and difficult to detect using conventional anti-virus software.

For example, a host may be infected if it periodically contacts a server via Internet Relay Chat (IRC) protocol and sends a large number of emails afterwards.

These solutions usually involve complex and sophisticated pattern analysis techniques, and have been demonstrated to produce good false positive and false negative rates.

Images